@backstage/plugin-scaffolder-backend 4.0.3-next.1 → 4.0.3

package/dist/scaffolder/tasks/NunjucksWorkflowRunner.cjs.js

@@ -4,9 +4,8 @@ var errors = require('@backstage/errors');
 var fs = require('fs-extra');
 var jsonschema = require('jsonschema');
 var path = require('node:path');
-var nunjucks = require('nunjucks');
+var nunjitsu = require('nunjitsu');
 var winston = require('winston');
-var SecureTemplater = require('../../lib/templating/SecureTemplater.cjs.js');
 var helper = require('./helper.cjs.js');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
@@ -40,12 +39,22 @@ function _interopNamespaceCompat(e) {
 
 var fs__default = /*#__PURE__*/_interopDefaultCompat(fs);
 var path__default = /*#__PURE__*/_interopDefaultCompat(path);
-var nunjucks__default = /*#__PURE__*/_interopDefaultCompat(nunjucks);
 var winston__namespace = /*#__PURE__*/_interopNamespaceCompat(winston);
 
 const isValidTaskSpec = (taskSpec) => {
   return taskSpec.apiVersion === "scaffolder.backstage.io/v1beta3";
 };
+function stringifyEachLogValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(
+      (item) => item === null || item === void 0 ? "" : stringifyEachLogValue(item)
+    ).join(",");
+  }
+  if (value !== null && typeof value === "object") {
+    return "[object Object]";
+  }
+  return String(value);
+}
 const createStepLogger = ({
   task,
   step,
@@ -96,17 +105,19 @@ const isActionAuthorized = pluginPermissionNode.createConditionAuthorizer(
   Object.values(rules.scaffolderActionRules)
 );
 class NunjucksWorkflowRunner {
-  defaultTemplateFilters;
+  defaultTemplateCapabilities;
   options;
   environment = { parameters: {}, secrets: {} };
   tracker;
   constructor(options) {
     this.options = options;
-    this.defaultTemplateFilters = templating.convertFiltersToRecord(
-      createDefaultFilters.createDefaultFilters({
-        integrations: this.options.integrations
-      })
-    );
+    this.defaultTemplateCapabilities = templating.collectTemplateCapabilities({
+      filters: templating.convertFiltersToRecord(
+        createDefaultFilters.createDefaultFilters({
+          integrations: this.options.integrations
+        })
+      )
+    });
     this.tracker = scaffoldingTracker(options.metrics);
   }
   async getEnvironmentConfig() {
@@ -122,47 +133,11 @@ class NunjucksWorkflowRunner {
       secrets: {}
     };
   }
-  isSingleTemplateString(input) {
-    const { parser, nodes } = nunjucks__default.default;
-    const parsed = parser.parse(
-      input,
-      {},
-      {
-        autoescape: false,
-        tags: {
-          variableStart: "${{",
-          variableEnd: "}}"
-        }
-      }
-    );
-    return parsed.children.length === 1 && !(parsed.children[0]?.children?.[0] instanceof nodes.TemplateData);
-  }
-  render(input, context, renderTemplate) {
+  render(input, context, templateRenderer) {
     return JSON.parse(JSON.stringify(input), (_key, value) => {
       try {
         if (typeof value === "string") {
-          try {
-            if (this.isSingleTemplateString(value)) {
-              const wrappedDumped = value.replace(
-                /\${{(.+)}}/g,
-                "${{ ( $1 ) | dump }}"
-              );
-              const templated2 = renderTemplate(wrappedDumped, context);
-              if (templated2 === "") {
-                return void 0;
-              }
-              return JSON.parse(templated2);
-            }
-          } catch (ex) {
-            this.options.logger.error(
-              `Failed to parse template string: ${value} with error ${ex.message}`
-            );
-          }
-          const templated = renderTemplate(value, context);
-          if (templated === "") {
-            return void 0;
-          }
-          return templated;
+          return templateRenderer.renderValue(value, context);
         }
       } catch {
         return value;
@@ -170,7 +145,7 @@ class NunjucksWorkflowRunner {
       return value;
     });
   }
-  async executeStep(task, step, context, renderTemplate, taskTrack, workspacePath, decision) {
+  async executeStep(task, step, context, preparedContext, templateRenderer, taskTrack, workspacePath, decision) {
     const stepTrack = await this.tracker.stepStart(task, step);
     if (task.cancelSignal.aborted) {
       throw new Error(
@@ -178,9 +153,9 @@ class NunjucksWorkflowRunner {
       );
     }
     try {
-      if (step.if === false || typeof step.if === "string" && step.each === void 0 && !helper.isTruthy(this.render(step.if, context, renderTemplate))) {
+      if (step.if === false || typeof step.if === "string" && step.each === void 0 && !helper.isTruthy(this.render(step.if, preparedContext, templateRenderer))) {
         await stepTrack.skipFalsy();
-        return;
+        return preparedContext;
       }
       const action = await this.options.actionRegistry.get(step.action, {
         credentials: await task.getInitiatorCredentials()
@@ -204,18 +179,11 @@ class NunjucksWorkflowRunner {
             "***"
           ])
         );
-        const debugInput = (step.input && this.render(
-          step.input,
-          {
-            ...context,
-            environment: {
-              parameters: this.environment?.parameters || {},
-              secrets: redactedEnvironmentSecrets
-            },
-            secrets: redactedSecrets
-          },
-          renderTemplate
-        )) ?? {};
+        const dryRunContext = preparedContext.withValue(["environment"], {
+          parameters: this.environment?.parameters || {},
+          secrets: redactedEnvironmentSecrets
+        }).withValue(["secrets"], redactedSecrets);
+        const debugInput = (step.input && this.render(step.input, dryRunContext, templateRenderer)) ?? {};
         taskLogger.info(
           `Running ${action.id} in dry-run mode with inputs (secrets redacted): ${JSON.stringify(
             debugInput,
@@ -233,7 +201,10 @@ class NunjucksWorkflowRunner {
           } else {
             context.steps[step.id] = { output: {} };
           }
-          return;
+          return preparedContext.withValue(
+            ["steps", step.id],
+            context.steps[step.id]
+          );
         }
       }
       const preIterationContext = {
@@ -244,7 +215,14 @@ class NunjucksWorkflowRunner {
         },
         secrets: task.secrets ?? {}
       };
-      const resolvedEach = step.each && this.render(step.each, preIterationContext, renderTemplate);
+      const preparedPreIterationContext = preparedContext.withValue(
+        ["environment"],
+        preIterationContext.environment
+      ).withValue(
+        ["secrets"],
+        preIterationContext.secrets
+      );
+      const resolvedEach = step.each && this.render(step.each, preparedPreIterationContext, templateRenderer);
       if (step.each && !resolvedEach) {
         throw new errors.InputError(
           `Invalid value on action ${action.id}.each parameter, "${step.each}" cannot be resolved to a value`
@@ -253,13 +231,17 @@ class NunjucksWorkflowRunner {
       const iterations = (resolvedEach ? Object.entries(resolvedEach).map(([key, value]) => ({
         each: { key, value }
       })) : [{}]).map((i) => {
-        const fullContext = { ...preIterationContext, ...i };
-        const shouldRun = !("each" in i) || !step.if || helper.isTruthy(this.render(step.if, fullContext, renderTemplate));
+        const preparedFullContext = "each" in i ? preparedPreIterationContext.withValue(
+          ["each"],
+          i.each
+        ) : preparedPreIterationContext;
+        const shouldRun = !("each" in i) || !step.if || helper.isTruthy(this.render(step.if, preparedFullContext, templateRenderer));
         return {
           ...i,
+          preparedContext: preparedFullContext,
           shouldRun,
           // Secrets are only passed when templating the input to actions for security reasons
-          input: step.input ? this.render(step.input, fullContext, renderTemplate) : {}
+          input: step.input ? this.render(step.input, preparedFullContext, templateRenderer) : {}
         };
       });
       for (const iteration of iterations) {
@@ -301,7 +283,7 @@ class NunjucksWorkflowRunner {
             taskLogger.info(
               `Skipping step each: ${JSON.stringify(
                 iteration.each,
-                (k, v) => k ? String(v) : v,
+                (key, value) => key ? stringifyEachLogValue(value) : value,
                 0
               )}`
             );
@@ -310,7 +292,7 @@ class NunjucksWorkflowRunner {
           taskLogger.info(
             `Running step each: ${JSON.stringify(
               iteration.each,
-              (k, v) => k ? String(v) : v,
+              (key, value) => key ? stringifyEachLogValue(value) : value,
               0
             )}`
           );
@@ -319,19 +301,11 @@ class NunjucksWorkflowRunner {
           const hasSecrets = Object.keys(task.secrets ?? {}).length > 0 || Object.keys(this.environment?.secrets ?? {}).length > 0;
           if (hasSecrets) {
             try {
-              const contextNoSecrets = {
-                ...preIterationContext,
-                ...iteration.each ? { each: iteration.each } : {},
-                secrets: {},
-                environment: {
-                  ...preIterationContext.environment,
-                  secrets: {}
-                }
-              };
+              const preparedContextNoSecrets = iteration.preparedContext.withValue(["secrets"], {}).withValue(["environment", "secrets"], {});
               const inputWithoutSecrets = this.render(
                 step.input,
-                contextNoSecrets,
-                renderTemplate
+                preparedContextNoSecrets,
+                templateRenderer
               );
               taskLogger.addRedactions(
                 collectSecretRedactions(iteration.input, inputWithoutSecrets)
@@ -354,28 +328,38 @@ class NunjucksWorkflowRunner {
             const key = `v1.task.checkpoint.${step.id}.${checkpointKey}`;
             try {
               let prevValue;
-              if (prevTaskState) {
-                const prevState = prevTaskState.state?.checkpoints?.[key];
-                if (prevState && prevState.status === "success") {
-                  prevValue = prevState.value;
+              let value;
+              try {
+                if (prevTaskState) {
+                  const prevState = prevTaskState.state?.checkpoints?.[key];
+                  if (prevState && prevState.status === "success") {
+                    prevValue = prevState.value;
+                  }
                 }
+                value = prevValue !== void 0 ? prevValue : await fn();
+              } catch (err) {
+                try {
+                  await task.updateCheckpoint?.({
+                    key,
+                    status: "failed",
+                    reason: errors.stringifyError(err)
+                  });
+                } catch (persistenceError) {
+                  throw new AggregateError(
+                    [err, persistenceError],
+                    `Checkpoint '${checkpointKey}' failed and its failure state could not be persisted`
+                  );
+                }
+                throw err;
               }
-              const value = prevValue ? prevValue : await fn();
-              if (!prevValue) {
-                task.updateCheckpoint?.({
+              if (prevValue === void 0) {
+                await task.updateCheckpoint?.({
                   key,
                   status: "success",
                   value: value ?? {}
                 });
               }
               return value;
-            } catch (err) {
-              task.updateCheckpoint?.({
-                key,
-                status: "failed",
-                reason: errors.stringifyError(err)
-              });
-              throw err;
             } finally {
               await task.serializeWorkspace?.({ path: workspacePath });
             }
@@ -410,12 +394,17 @@ class NunjucksWorkflowRunner {
         await fs__default.default.remove(tmpDir);
       }
       context.steps[step.id] = { output: stepOutput };
+      const updatedPreparedContext = preparedContext.withValue(
+        ["steps", step.id],
+        context.steps[step.id]
+      );
       if (task.cancelSignal.aborted) {
         throw new Error(
           `Step ${step.id} (${step.name}) of task ${task.taskId} has been cancelled.`
         );
       }
       await stepTrack.markSuccessful();
+      return updatedPreparedContext;
     } catch (err) {
       await taskTrack.markFailed(step, err);
       await stepTrack.markFailed();
@@ -432,17 +421,18 @@ class NunjucksWorkflowRunner {
     }
     const taskId = await task.getWorkspaceName();
     const workspacePath = path__default.default.join(this.options.workingDirectory, taskId);
-    const { additionalTemplateFilters, additionalTemplateGlobals } = this.options;
+    const { templateCapabilities } = this.options;
     this.environment = await this.getEnvironmentConfig();
     const taskState = { failed: false };
     const statusCheckInvoked = { value: false };
-    const { render: renderTemplate, dispose } = await SecureTemplater.SecureTemplater.loadRenderer({
-      templateFilters: {
-        ...this.defaultTemplateFilters,
-        ...additionalTemplateFilters
+    const templateRenderer = nunjitsu.createTemplateRenderer({
+      allowRegexExecution: true,
+      filters: {
+        ...this.defaultTemplateCapabilities.filters,
+        ...templateCapabilities?.filters
       },
-      templateGlobals: {
-        ...additionalTemplateGlobals,
+      globals: {
+        ...templateCapabilities?.globals,
         always: () => {
           statusCheckInvoked.value = true;
           return true;
@@ -471,6 +461,9 @@ class NunjucksWorkflowRunner {
           }
         }
       };
+      let preparedContext = templateRenderer.prepareContext(
+        context
+      );
       const [decision] = this.options.permissions && task.spec.steps.length ? await this.options.permissions.authorizeConditional(
         [{ permission: alpha.actionExecutePermission }],
         { credentials: await task.getInitiatorCredentials() }
@@ -487,7 +480,7 @@ class NunjucksWorkflowRunner {
             continue;
           }
           statusCheckInvoked.value = false;
-          this.render(step.if, context, renderTemplate);
+          this.render(step.if, preparedContext, templateRenderer);
           if (!statusCheckInvoked.value) {
             await task.emitLog(
               `Skipping step ${step.id} because a previous step failed`,
@@ -497,11 +490,12 @@ class NunjucksWorkflowRunner {
           }
         }
         try {
-          await this.executeStep(
+          preparedContext = await this.executeStep(
             task,
             step,
             context,
-            renderTemplate,
+            preparedContext,
+            templateRenderer,
             taskTrack,
             workspacePath,
             decision
@@ -534,7 +528,11 @@ ${error.stack}`,
         }
         throw firstError;
       }
-      const output = this.render(task.spec.output, context, renderTemplate);
+      const output = this.render(
+        task.spec.output,
+        preparedContext,
+        templateRenderer
+      );
       if (Array.isArray(output?.links)) {
         output.links = helper.filterConditionalItems(output.links);
       }
@@ -545,10 +543,6 @@ ${error.stack}`,
       await task.cleanWorkspace?.();
       return { output };
     } finally {
-      try {
-        dispose();
-      } catch {
-      }
       if (workspacePath) {
         await fs__default.default.remove(workspacePath);
       }